REMARKS 

Applicants have studied the Office Action dated December 21 , 2006 and have made 
amendments to claims 1, 3-8, 10-13, 15-22. No new matter was added. 
Reconsideration and allowance of the pending claims in view the following remarks are 
respectfully requested. Applicants submit that the application is in condition for 
allowance. In the Office Action, the Examiner: 

• Objected to claims 1 1 and 1 3 because of various informalities; 

• Rejected claims 1 5-1 8 under 35 U.S.C. § 1 01 for being directed towards a 
"service"; 

• Rejected claims 20-22 under 35 U.S.C. § 101 for being directed towards 
software per se; 

• Rejected claims 1 5-1 7 under 35 U.S.C. § 1 02(e) as being unpatentable over 
Naslund et al. U.S. Patent Publication No. 2005/0246282; 

• Rejected claims 1 -2, 4-9, 1 8, and 20-22 under 35 U.S.C. § 1 03(a) as being 
unpatentable over Naslund et al. U.S. Pre-grant Publication No. 2005/0246282 in 
view of Bhat U.S. Pre-grant Publication No. 2003/0055809; 

• Rejected claim 3 under 35 U.S.C. § 103(a) as being unpatentable over Naslund 
et al. U.S. Pre-grant Publication No. 2005/0246282 in view of Bhat U.S. Pre- 
grant Publication No. 2003/0055809 and in further view of Dankick U.S. Patent 
No. 5828864; and 

• Rejected claims 1 0-1 4, 1 9, and 22 under 35 U.S.C. § 1 03(a) as being 
unpatentable over Naslund et al. U.S. Pre-grant Publication No. 2005/0246282 in 
view of Bhat U.S. Pre-grant Publication No. 2003/0055809 and in further view of 
Dankick U.S. Patent No. 5828864. 
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Claim Objections 



As noted above, the Examiner objected to claims 1 1 and 13 because of various 
informalities. The Applicants have carefully amended claim 1 1 to more clearly recite "a 
user input". The Applicants have also amended claim 13 to more clearly recite "logging 
the software operation activity " as compared to "logging an even". Therefore, the 
Applicants respectfully suggest that the objections to claims 1 1 and 13 have been 
overcome and should be withdrawn. 



Rejection under 35 U.S.C. 6 101 

As noted above, the Examiner rejected claims 15-19 and 20-22 under 35 U.S.C. § 101. 
With respect to claims 15-19, the Applicants have amended claims 15-19 to more 
clearly recite "method" and not "service". With respect to claims 20-22, the Applicants 
have amended claims 20-22 to recite "a computer program product for analyzing 
software running in a tamper-resistant environment, the computer program product 
comprising instructions for..." Therefore, the Applicants believe that the rejection under 
35 U.S.C. § 101 has been overcome and should be withdrawn. 

Rejection under 35 U.S.C. § 102(e) 
As noted above, the Examiner rejected claims 15-17 under 35 U.S.C. § 102(e) as being 
unpatentable over Naslund et al. U.S. Patent Publication No. 2005/0246282. 
Independent claim 15 has been amended to more clearly recite the present invention. 

In particular, the presently claimed invention now more clearly recites: 

A method of analyzing the operation of software in a remote protected 
processing environment, the method including: 

receiving from the remote protected processing environment an 
encrypted log file of substantially-constant size comprising at least one log entry 
with at least one set of data derived from at least one instance of software 
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execution monitored in response to a user identifying and selecting the one 
instance of software execution, whereby the set of data is used to diagnose the 
software execution ; 

determining a decrypting key for the encrypted log file and decrypting 
the encrypted log file; 

analyzing the log entry at the remote protected processing environment 
to determine whether an operation corresponding to the set of data derived from 
the at least one instance of software execution of the remote protected 
processing environment is appropriate ; and 

reporting results of the analyzing step. 



With respect to claim 15, the Examiner states that Naslund, at paragraph [0081] 
teaches "the security operation unit then comprises a public key. The encrypted usage 
information can then only be ready (Sic) by the trusted party using its private key for 
decryption of the cryptographically protected information". The Examiner uses this 
teaching of Naslund in support of the rejection of claim 15. 

However, "determining a decrypting key for the encrypted log file and decrypting the 
encrypted log file" is only one element out of many in claim 15 and a proper rejection 
under 35 U.S.C. § 102(e) requires that a single reference teach (i.e., identically 
describe) each and every element of the rejected claims as being anticipated by 
Naslund. 1 Therefore, the Examiner has failed to prove that Naslund teaches each and 
every element of claim 1 5. 



1 See MPEP §2131 (Emphasis Added) "A claim is anticipated only if each and 
every element as set forth in the claim is found, either expressly or inherently described, 
in a single prior art reference." Verdegaal Bros. v. Union Oil Co. of California, 814 F.2d 
628, 631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). "The identical invention must be 
shown in as complete detail as is contained in the ... claim." 
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Furthermore, Naslund is directed towards monitoring usage of digital content by a user. 
The motivation behind Naslund is to record the usage of digital content by a user so 
that usage disputes do not arise. For example, Naslund is trying to prevent the 
situation where a user states that he/she only played a song three times when in fact 
he/she played a song five times. See Naslund at paragraphs [0002] to [0006], [0026] to 
[0032]. A logging agent monitors the use of the content such as playing a song. The 
generated usage information is authenticated and stored as a log entry in a log. The 
usage information can also be encrypted. 

The present invention on the other had, now more clearly recites "receiving from the 
remote protected processing environment an encrypted log file of substantially-constant 
size comprising at least one log entry with at least one set of data derived from at least 
one instance of software execution monitored in response to a user identifying and 
selecting the one instance of software execution, whereby the set of data is used to 
diagnose the software execution : determining a decrypting key for the encrypted log file 
and decrypting the encrypted log file; analyzing the log entry at the remote protected 
processing environment to determine whether an operation corresponding to the set of 
data derived from the at least one instance of software execution of the remote 
protected processing environment is appropriate ; and reporting results of the analyzing 
step. 

In other words, the present invention is directed towards the diagnosis or analysis of 
software execution within a data processing system that includes a protected operating 
environment. Nowhere does Naslund teach or suggest "receiving from the remote 
protected processing environment an encrypted log file of substantially-constant size 
comprising at least one log entry with at least one set of data derived from at least one 
instance of software execution monitored in response to a user identifying and selecting 
the one instance of software execution, whereby the set of data is used to diagnose the 
software execution ". Naslund is completely silent on an encrypted log file being 
substantially constant size. The constant fixed size of the log file prevents the log file 
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from being monitored by malicious programs or users. For example, the fixed size 
reduces the chance that its role as a trace log will be apparent from a monitoring of the 
log and that the events being monitored will be apparent to an attacker. This makes the 
log file and the system as a whole harder to attack. Nowhere does Naslund teach this 
claim element. 

Furthermore, Naslund teaches only monitoring usage information of content that can 
include content quality parameters. In other words, Naslund only teaches monitoring 
how a user uses the content and the content's quality. This usage information is then 
stored within a log file. The presently claimed invention, on the other hand teaches that 
the encrypted log file comprises "at least one set of data derived from at least one 
instance of software execution monitored. .. whereby the set of data is used to diagnose 
the software execution" . This is completely different than Naslund's teaching of usage 
information. For example, the presently claimed invention monitors how the software is 
executing for debugging and analysis purposes, while Naslund monitors how a user 
uses content for license/policy enforcement. 

Additionally, the presently claimed invention recites "...at least one set of data derived 
from at least one instance of software execution monitored in response to a user 
identifying and selecting the one instance of software execution In other words, a 
user initiates the monitoring/logging and selects what is to be monitored/logged. Also, 
the monitoring is can only be for one instance of software execution and does not have 
to be for every instance. Naslund, on the other hand, is completely silent on this claim 
element. For example, Naslund teaches that whenever a user uses the content usage 
information is generated. If a user plays a song 5 times, Naslund teaches that usage 
information for each of the 5 times is recorded. Assuming arguendo that Naslund and 
the presently claimed invention teaches logging and monitoring the same type of data 
(which they do not), Naslund would have to teach that of the 5 times a song is played a 
user can select which of the 5 times data should be logged. Naslund clearly does not 
teach this. In fact, this is completely against what Naslund is trying to accomplish. For 
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example, Naslund logging usage information to maintain a reliable record of whether or 
not a user is complying with a DRM policy. If a user is able to select when logging 
should occur in Naslund, a user could circumvent DRM policies associated with the 
content. For example, if a user is only allowed to play a song 3 times a user could only 
have usage information recorded for two times. This completely defeats the purpose of 
Naslund. 

Further yet, nowhere does Naslund teach "analyzing the log entry at the remote 
protected processing environment to determine whether an operation corresponding to 
the set of data derived from the at least one instance of software execution of the 
remote protected processing environment is appropriate ". Naslund is completely silent 
on this element. 

With respect to claim 16, which depends from claim 15, the Examiner states that the 
"logging agent (Fig. 2, 150) inherently requires an initializing mechanism to determine 
when the logging is to begin..." However, nowhere does Naslund teach "providing an 
instruction to initiate a logging of messages each time logging is desired bv the user . 

For the foregoing reasons, Claim 15 distinguishes over Naslund. Claims 16-17 depend 
from claim 15. Since dependent claims include all the limitations of the independent 
claims, claims 16-17 distinguish over Naslund, as well. Accordingly, Applicants believe 
that the rejection under 35 U.S.C. § 102(e) has been overcome and respectfully request 
that this rejection be withdrawn. 

Rejection under 35 U.S.C. § 103 

As noted above, the Examiner rejected claims 1-2, 4-9, 18, and 20-22 under 35 U.S.C. 
§ 103(a) as being unpatentable over Naslund et al. U.S. Pre-grant Publication No. 
2005/0246282 in view of Bhat U.S. Pre-grant Publication No. 2003/0055809. With 
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respect to claim 1, the Examiner states that Naslund does not teach "random data in 
the log file when it is originally created and which is replaced by log entries so that the 
size of the log containing log entries appears to be a substantially-constant size; and a 
pointer which identified the next storage location for the next log entry so that the last 
log entry can be determined and the next log entry can be positioned in a location in the 
log after the previous log entry". 



However, the Examiner goes on to combine Naslund with Bhat stating that teaches 
"creating the new log record may include. ..using a ...pseudorandom process that 
creates a unique signature" Paragraph [0077]. The Examiner also states that Bhat 
teaches "all log records are placed in the same log file until it has reached maximum 
capacity". Paragraph [0076]. "The Examiner interprets maximum capacity as the 
substantially constant size". 



With respect to claim 1 , the presently claimed invention now more clearly recites: 

a processor which monitors at least one instance of software 
execution identified and selected by a user to be monitored and creates a 
log entry with fef at least one set of data derived from the one instance of 
software execution, whereby the set of data is used to diagnosis the 
software execution ; 

an encryption system which encrypts the log entry for the at least 
one set of data ; 

a log file of a relatively-fixed size which stores the log entry for the 
at least one set of data which have been encrypted ; 

random data in the log file when it is originally created and which is 
replaced by log entries so that a size of the log f_Ne including log entries 
appears to be a substantially-constant size; and 

a pointer which identifies a next storage location for a next log entry 
so that a last log entry can be determined and the next log entry can be 
positioned in a location in the log file after a previous log entry. 

The arguments made above with respect to claim 15 are also applicable here and will 
not be repeated. Additionally, nowhere does Bhat teach or suggest "random data in the 
log file when it is originally created and which is replaced by log entries so that a size of 
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the log file including log entries appears to be a substantially-constant size". At 

paragraph [0077] Bhat teaches 

Once the appropriate log file header information is obtained, logging 
service 141 may create a new log record associated with the request 
(Step 540). Creating the new log record may include generating a unique 
hashcode for the new log record. The hashcode may be generated using 
a number of techniques including, but not limited to, a pseudorandom 
process that creates a unique signature based on data located in log 
record. Also, the type of severity and category value to be placed in 
severity and category fields 422 and 424, respectively, may be determined 

At paragraph [0076] Bhat teaches 

Once the request is received, logging service 141, through API 147, 
determines the appropriate log file where the new log record is to be 
located (Step 520). The log file may be designated by client 110 in the 
request, or alternatively, logging service 141 may be configured to analyze 
the request to determine the appropriate log file. For example, a request 
associated with an error event may direct logging service 141 to place a 
log record in a log file dedicated to error log records. In one configuration 
consistent with certain principles related to the present invention, all log 
records are placed in the same log file until it has reached maximum 
capacity, where another log file is used to continue storing new log 
records. After the appropriate log file is determined, (i.e., log file 145), 
logging service 141 may access log file header 310 to determine the 
record marker 315 that needs to be used for record marker 410 
associated with the new log record to be created (Step 530). Additionally, 
logging service 141 may also access last record offset 312 to obtain the 
pointer to the end of log file 145 in order to allow the new log record to be 
directly placed at the end of the last log record in log file 145. For 
example, referring to FIG. 3, a new log record that is created may be 
placed in a location in log file 145 that is immediately following log record 
320-12 by using last record offset 312. 

Neither here nor anywhere else in Bhat does Bhat teach "random data in the log file 
when it is originally created and which is replaced by log entries so that a size of the log 
file including log entries appears to be a substantially-constant size". The random data 
is placed within the log file so that the log file keeps a constant size. When a log entry 
is placed within the log file a corresponding amount of generated data is replaced by 
the log entry. The remaining random data is still in the log file until replaced. This 
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allows the log file to remain the same size throughout the logging process, hence claim 
1 recites "random data in the log file when it is originally created and which is replaced 
by log entries so that a size of the log file including log entries appears to be a 
substantially-constant size ". Bhat does not teach this. Also, the Examiner incorrectly 
assumes that "maximum capacity" in Bhat is the same as "substantially-constant size" 
of the presently claimed invention. Bhat teaches "all log records are placed in the same 
log file until it has reached maximum capacity". Nowhere does this recite that "random 
data in the log file when it is originally created and which is replaced by log entries so 
that a size of the log file including log entries appears to be a substantially-constant 
size ". Bhat teaches log records are added to a log file until no more records can be 
added thereby requiring a new log file to be created. Nowhere does Bhat teach that 
random data is replaced by log entries. Furthermore, if the Examiner wants to equate 
Bhat's hash-code to the presently claimed random data (which it is not) then Bhat has 
to teach that the hash-code is replaced by the log records, which Bhat clearly does not 
teach. 

With respect to claim 20, the remarks and arguments made above with respect to 
claims 15 and 1 are also applicable in support of claim 20 and will not be repeated 
here. 

For the foregoing reasons, Claims 1 and 20 distinguish over Naslund alone and/or in 
combination with Bhat. Claims 2, 4-9, 18, and 21-22 depend from claims 1 and 20, 
respectively. Since dependent claims include all the limitations of the independent 
claims, claims 2, 4-9, 18, and 21-22 distinguish over Naslund alone and/or in 
combination with Bhat, as well. Accordingly, Applicants believe that the rejection under 
35 U.S.C. § 103(a) has been overcome and respectfully request that this rejection be 
withdrawn. 

As noted above, the Examiner rejected claim 3 under 35 U.S.C. § 103(a) as being 
unpatentable over Naslund et al. U.S. Pre-grant Publication No. 2005/0246282 in view 
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of Bhat U.S. Pre-grant Publication No. 2003/0055809 and in further view of Dankick 
U.S. Patent No. 5828864. Claim 3 depends from claim 1 and since dependent claims 
include all the limitations of the independent claims, claim 3 distinguishes over Naslund 
alone and/or in combination with Bhat and/or in combination with Dankick, as well 

As noted above, the Examiner ejected claims 10-14, 19, and 22 under 35 U.S.C. § 
103(a) as being unpatentable over Naslund et al. U.S. Pre-grant Publication No. 
2005/0246282 in view of Bhat U.S. Pre-grant Publication No. 2003/0055809 and in 
further view of Dankick U.S. Patent No. 5828864. The above arguments made with 
respect to claims 1 and 15 area also applicable in support of claims 10-14, 19, and 22 
and therefore will not be repeated. Claims 13-14, 19, and 22 depend from claims 10, 
15, and 20, respectively. Since dependent claims include all the limitations of the 
independent claims, claims 13-14, 19, and 22 distinguish over Naslund alone and/or in 
combination with Bhat and/or in combination with Dankick, as well 

For the foregoing reasons, Claim 10 and 20 distinguish over Naslund alone and/or in 
combination with Bhat. Claims 2, 4-9, 18, and 21-22 depend from claims 1 and 20, 
respectively. Since dependent claims include all the limitations of the independent 
claims, claims 2, 4-9, 18, and 21-22 distinguish over Naslund alone and/or in 
combination with Bhat, as well. Accordingly, Applicants believe that the rejection under 
35 U.S.C. § 103(a) has been overcome and respectfully request that this rejection be 
withdrawn. 



CONCLUSION 

Applicants acknowledge the continuing duty of candor and good faith to disclosure of 
information known to be material to the examination of this application. In accordance 
with 37 CFR § 1 .56, all such information is dutifully made of record. The foreseeable 
equivalents of any territory surrendered by amendment is limited to the territory taught 
by the information of record. No other territory afforded by the doctrine of equivalents is 
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knowingly surrendered and everything else is unforeseeable at the time of this 
amendment by the Applicants and their attorneys. 

Applicants respectfully submit that all of the grounds for rejection stated in the 
Examiner's Office Action have been overcome and that all claims in the application are 
allowable. No Previously Presented matter has been added. It is believed that the 
application is now in condition for allowance or alternatively is in better form for 
consideration on appeal, which allowance is respectfully requested. 

PLEASE CALL the undersigned if that would expedite the prosecution of this 
application. 

Respectfully Submitted, 



Date: March 21, 2007 By: /Jon Gibbons/ 

Attorney for the Applicants 
Jon A. Gibbons 
(Reg. No. 37,333) 

Fleit, Kain, Gibbons, Gutman, 
Bongini & Bianco P.L. 
551 N.W. 77 th Street, Suite 1 1 1 
Boca Raton, FL 33487 
Telephone No.: (561) 989-9811 
Facsimile No.: (561)989-9812 
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